apache/cassandra · error · ConfigurationException

No identity was extracted from the outbound keystore '%s'

Error message

No identity was extracted from the outbound keystore '%s'

What it means

Thrown as a ConfigurationException when the outbound keystore configured in server_encryption_options either does not exist, is unreadable/malformed, or contains no extractable identity. MutualTlsInternodeAuthenticator requires at least one identity to authenticate outgoing internode connections, so startup fails.

Source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:146

                String nodeIdentity = parameters.get(NODE_IDENTITY);
                if (!trustedIdentities.contains(nodeIdentity))
                {
                    throw new ConfigurationException("Configured node identity is not matching identity extracted" +
                                                     "from the keystore");
                }
                trustedIdentities.retainAll(Collections.singleton(nodeIdentity));
            }
        }

        if (!trustedIdentities.isEmpty())
        {
            logger.info("Initializing internode authenticator with identities {}", trustedIdentities);
        }
        else
        {
            String message = String.format("No identity was extracted from the outbound keystore '%s'", config.server_encryption_options.outbound_keystore);
            logger.info(message);
            throw new ConfigurationException(message);
        }

        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);
        certificateValidityWarnThreshold = config.server_encryption_options.certificate_validity_warn_threshold;
    }

    @Override
    public boolean authenticate(InetAddress remoteAddress, int remotePort)
    {
        throw new UnsupportedOperationException("mTLS Authenticator only supports certificate based authenticate method");
    }

    @Override
    public boolean authenticate(InetAddress remoteAddress, int remotePort, Certificate[] certificates, InternodeConnectionDirection connectionType)
    {
        return authenticateInternodeWithMtls(remoteAddress, remotePort, certificates, connectionType);
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Verify outbound_keystore path exists and is readable by the cassandra user
2. Inspect the keystore with keytool -list and confirm it contains a private-key/certificate entry
3. Regenerate the keystore with the node certificate if it is empty or corrupt
4. Confirm keystore type (PKCS12/JKS) and password match the configuration

Example fix

// before
server_encryption_options:
  outbound_keystore: /etc/cassandra/empty.p12
// after
$ keytool -list -keystore /etc/cassandra/outbound.p12  # confirm entries
server_encryption_options:
  outbound_keystore: /etc/cassandra/outbound.p12

// shell preflight
if [ ! -r "$OUTBOUND_KEYSTORE" ]; then echo "keystore missing/unreadable"; exit 1; fi
keytool -list -keystore "$OUTBOUND_KEYSTORE" -storepass "$KS_PASS" | grep -q 'PrivateKeyEntry' || { echo 'no identity entry'; exit 1; }

try { authenticator.validateConfiguration(); }
catch (ConfigurationException e) { LOG.error("Outbound keystore has no identity: " + e.getMessage()); throw e; }

When it happens

Trigger: Initializing the authenticator with config.server_encryption_options.outbound_keystore pointing to an empty, missing, corrupt, or password-protected-wrongly keystore from which no identity can be extracted.

Common situations: Wrong keystore path in cassandra.yaml; keystore created without any certificate entry; unsupported keystore type/format; permissions preventing the Cassandra process from reading the file.

Related errors

• Configured node identity is not matching identity extractedf
• MutualTlsInternodeAuthenticator requires server_encryption_o
• Full chain/private key is not present in the keystore for ce
• MutualTlsWithPasswordFallbackAuthenticator requires client_e
• legacy_ssl_storage_port_enabled is true (enabled) with inter

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/2ea669ef7f0bad56. Report an issue: GitHub.